Moussa, good question. Though I would disclaim that I am not a lawyer so the definitive answer rests with your compliance officer, my answer actually depends on whether the clinic is dispensing (patient walks out with the product) or administering it in-office (buy-and-bill infusions, injectables, in-office chemo, etc.) — DSCSA treats those two situations differently.
If the clinic only administers product in-office and never sends it home with a patient, there’s a specific practitioner exemption in the statute (21 U.S.C. 360eee-1) for licensed practitioners administering product in the usual course of professional practice. That exemption removes the product tracing and verification requirements — you’re not required to capture or maintain Transaction Information and Transaction Statements the way a pharmacy dispenser is. It doesn’t remove everything, though: you’re still required to only receive serialized product and to only transact with authorized trading partners. So even under the exemption, most practices end up wanting some record of what came in and from whom, just not the full TI/TH/TS package a pharmacy has to keep.
If the clinic dispenses in the pharmacy sense (fills a prescription the patient takes home), the exemption doesn’t apply and full dispenser obligations kick in: six-year retention of transaction records, verification obligations for suspect or illegitimate product and for saleable returns, and the ability to produce transaction information within two business days if the FDA or a state official requests it as part of a recall or investigation.
On your actual question — does the clinic need to store the serialized data itself, or is wholesaler portal access enough — for that second, full-dispenser case: a wholesaler’s portal can absolutely be part of a compliant setup, and DSCSA doesn’t say the data has to live on your own server. But the legal recordkeeping, verification, and quarantine obligations stay with the dispenser, not the wholesaler. The wholesaler storing the data on your behalf doesn’t transfer your obligation to produce it — so if that portal access lapses, the wholesaler relationship ends, or the data isn’t retrievable fast enough when FDA actually asks, that’s a compliance gap on the clinic’s side, not the wholesaler’s. That’s the practical risk a lot of practices are weighing when they decide whether “I’ll look it up in the portal if anyone ever asks” is good enough for six years, versus keeping their own copy.
Primary sources worth reading directly rather than taking my summary as the final word: 21 U.S.C. 360eee-1 for the statutory requirements and the practitioner exemption, and FDA’s DSCSA guidance page (fda.gov/drugs/drug-supply-chain-integrity/drug-supply-chain-security-act-dscsa) for the current guidance documents, including the waivers/exceptions/exemptions page. Since which bucket a given clinic falls into (administering-only vs. dispensing) genuinely changes the answer, and there’s real money/compliance risk either way, I’d run your specific setup past whoever handles your regulatory counsel rather than relying solely on a forum reply.